7635079472f751071c32a41949affd5f1e70a9f01c173f8e1ba0ae41302ea97e

Analysis

max time kernel
118s
max time network
164s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 08:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

RJ01082861-PC/credits.html
Size

1.9MB
MD5

525f99aea74965d6b490817f06ce2be6
SHA1

2f1b4686d54c0c4a3a332db7bdc1be00245bd383
SHA256

569d23bb9f7f8e12c0429e4267ee39a85fea4d7c2ee41b7d405f0ae66eb069b2
SHA512

270f182b96509228a67b1fb3f46144d1505d118a19bd8fc0613e79492b90e25bd816da8f42861a4b35017698fea9c87b3833ce15eb6f65f24cdda16691f7077a
SSDEEP

24576:OmuB6mnLiL9IrMr2KNnc7nkUhPwQQQVuc:OD6mLAcKTW7EQp

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 36 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000b149a4be0b1986c3f6c6dfb5fd6d508629a72508e6beaa38555479a830f016f4000000000e800000000200002000000091972b17040f5b4e72b4e9564ceef78476533b88cc84dd037b67b8ffaa338f3f200000009d31b2bb99582d39c21dcad0b9e9ce635909ed10f919258981b6ecc9641e39dd400000004afd8a0e8c610ea1cd205450105ce91c7bd647eabb7cb0c6358a438a346671cbf809d8181f867230bbb0d91aa18a748582d9dd7f2f0214ddbccda9118b2327e2	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "422700845"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000bd2a7708e9798e4fa0b20f3efd8e936100000000020000000000106600000001000020000000a442edf80c802a86f06d17231a20c81634b44234aa501d0a3eeb2b7a33e81110000000000e8000000002000020000000d7ba8a206f40c2787cf9cd95f986caaaf9324868b34dce1dc98b5697ef5762a490000000522e05ea0746a4637cc2a4862b9a8d195a5a97e68b23f16d4a207e4e6f85f837424472fc53b70382aeb2e495e15eddd7c415348276a00db6e7ae95c1e8ae158cc37d5cdfccc5f5ef581486b187a1b5e206d05df9d4e2f7083884bb61a5202a4c129fb37f8e3cc368b78f8ccbea038486560a8c750c185e67dac7fa5f2a7c9c4267bb3ed9546f53fd3f7fdf69b3e3b36f400000008469d454651a052a9e28fea81e712306c5ed16e6f5e77497eb431cf3f6fb0457cbe8c07335435fe86cb81277e6b6d6af3e6a16e5ec88613a36eb11e67100634c	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D2497631-19A6-11EF-91AA-4EB079F7C2BA} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3691908287-3775019229-3534252667-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 90d348a7b3adda01	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3020	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3020	iexplore.exe
3020	iexplore.exe
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE
2252	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2252	3020	iexplore.exe	28
PID 3020 wrote to memory of 2252	3020	iexplore.exe	28
PID 3020 wrote to memory of 2252	3020	iexplore.exe	28
PID 3020 wrote to memory of 2252	3020	iexplore.exe	28

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\RJ01082861-PC\credits.html
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3020 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
688e627a284b31297d4f1b116cb20292

SHA1
3c5bc95acf59f1ab14c4e573dbc6f762c31616cd

SHA256
07c67e6da69fcb35a20415f26da9d353bbc36f8ba57afb71ae9d66ea170c3d62

SHA512
a8b200978f80c4e4fb1031b21b9f8e0161bfb683c63ee36cdbbeca4a1993288687a90c0638063f24714f158774ec7aeeafc6559c0ab8faa44d89e799d82fbf65

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4af90b8cd94c95ac7b9ebc8d14663866

SHA1
ee7fd066abd5ef4cd157f14f42073372bb0a5373

SHA256
ba0fa80e5bd93b8ffc51ed4ad166320c907f1a416399a713334865da22f93362

SHA512
cb7aba9d8c0596f8fa325ed79f42463aa908c291afc9d9caa9d7882187027e08da6145c35ead2549ebebbffff2e9eddaea4194b7302eb2ec75d3b36af3566a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c5d7faa97179351e9d929f4d809c8b90

SHA1
7ebfb0311daaa68127dcd4917c9f3d03120f183a

SHA256
1fd9ad891764ad6b0a845a14aa6ac86e1e703af51267e1cff60f951529aa8842

SHA512
6b93e9a6922a73a28277446ffe3e8d2e983adc26b96faa71e00fdc8c79a2fa80b40cb991168f488b8f41ee74d4524082dba10772b099aa17c20eeb595804d9e6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
4b10c73b6565f094325dc3e7acc8f2ad

SHA1
d65699354321932e1b3941c7c917565c4f018e30

SHA256
f187210e1c685b2b3e6ad7d6a873cd305d26d43452013f1201064745285a6917

SHA512
2453ff6fa3c42d7a6ad831b11caa8a67906f1f7eabee8e336e4db1f0cba660bcdab284b42670e27d7fba28ea71dab8f71906dd7c31111bce2ccb5aa439c9c058

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
d837c98126f031cf5d6c8b4aaef98971

SHA1
df3fe4c0098d77c17c364d83de013bd808833577

SHA256
20ee12f8aae225c8453a51056a7e5b93561975068599c2ea3ad514566c2bf86e

SHA512
be8e97056b76203ea00679c744a3e0c3d060d76d82d8dc7d66915a6b6a5a28f71ce0331e6db7e0eee5df29bd47503beb540999cb4c78940216641b1bcb2c2348

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
778083257449e5e0d01b551a09030291

SHA1
ce97bf98b6c61d04b473317915acbe2d8f528435

SHA256
a43b93a69d6ec1fa92cd950e3e3baf8b8bed87b2b0537d6cdd0ac6f1f88c6c1f

SHA512
0d53d6fbb0ed847d6fc5d17fa0b13354a39ff93b0207824cc1028e9a0e1155c2ee46d078bed60f569d825c14d8ceac12a35ce4158d08305c9dc927720bc77f5a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
a07b771d888729b690a23f86ad97e55e

SHA1
c5cd84b146f9d62b17d6840985269d5bf01f53a4

SHA256
b3e56faffbf187e98d33bc62eb3f5c3ef8d8945b8e4c346de7e75af3e77dc079

SHA512
3d0f5a3b0d5ef655fb9dc6b0be49261447f34a95a3936f6bc21f5bcea396182eb903146f6f4e83995e80fb1c5e9ae50651d75f2409d309bbcbca750dc2916768

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
21475759d699e21c9fd80ffec177b116

SHA1
9261ed88b583da8bcc42537c63bf51abd727e062

SHA256
f8956dce1d7ba2fd095fc4d672e658721c039aefbd7c419db1949eeca63b290d

SHA512
08e20f5440732240fc8d513e92aef935de585047da9584787af60c764c863fd8eabb3fb7a14693c26e16b7ef446b0eae27fd93ec45f2731415d8f3be36275ff6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7ce03c1e5295c6321103dabf33f68fa9

SHA1
062b4b143adfa4c370633cee3b0bb88fc7a5c448

SHA256
32cefec937097b83b74742c40f2a90b2339ad1521eca30f586aad16f6d0b1dc3

SHA512
400ca5b3cf22ba0f55e0c95de8f28c4a06c5ffb8201debcd43866543bb38e129652a84dddb310e178deeb60ad843d340b6f870a94b38b43e090c00498de98e97

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
421226c40f64c3deaa4033009695294f

SHA1
3e91735dfdb28b531498199fb6b94f8bf0ed6f0e

SHA256
95792eb8339c1efe918437a79d37b25f61288bd08d5736548bc9bd5244aba407

SHA512
b7cc462826d7673b63ff0811f044523d77e986aa9ec2ed92c8bbe589266650b929ec6223ed71ac2cfc5bbf43c5a7022d0b7d8ff5f1e6777e93a6acc4ea24f27d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e21da504097c8b006b8d4a860b93c01c

SHA1
5d96e1f48bf5b4ecb510f598c3689d4d679777bd

SHA256
1c63d3457e260ef192945f2f68565ac3b9922c699fd4525821984be6969dae11

SHA512
a6f9188a70fddcaaff5c685636914eaf4f98120f9cefdd09b2e3d871840a0e4eb502f8043cb86dfc543457c020ac64e25a32abcb597ec088f4c297d6052411dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
1bae2bbc0caeb97cd0d2a2a0ebdbc600

SHA1
1097ae5a0f4fbf93ea410f149a73618148e98e08

SHA256
335eebdce8215e97af446a6cb6a766919ff817a7aba7b0da5a308b8c50590830

SHA512
268cadcb5775cfc2393a97a5348acce3e9e3aa12dc5f656c4892cc8b67933a70f4cb0f68a69c99e534e071bd9f87109592a3b81750a03d399216c0fa2a4da069

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
50ebd372528bb8d38bac45216ef79e3f

SHA1
82af49fb17b3322ed44a30b5541508e0b1c7744f

SHA256
cc92e6bb79757799b2ddfc9405e1166eb1e94ee2eae20b3b5973d194f0be0c52

SHA512
f9b5cd69ef2b5039790cd11f58202d4c588dabc88f2fde4cc14a6e365d3342ca873607069a043fdd3c6e069ab7f9519d86503324f1833ab387ace7bd675c2908

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
93395fc8086447e2d4e97446ed864e48

SHA1
8206b7762907b94cb100f6cadc743e3b5de4ef7e

SHA256
e12e9975e14fac8de9f53beb6e7cdc7836822a14d8a8849a0be8b28ad952e358

SHA512
707d8acaa39203ee31046cd292963fc38f36c3483313b8de0d850872df009355f632dfd86d3509d2faebc8d672422a7ad00f2f6f9117476efc94da960dc00ab0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
12a47a34ba66692e055adaea5a813bac

SHA1
80b5c69f802a6672748e4eaebf3b9befcc22b3c8

SHA256
b5fcb2e1286f3f3255cfe37f15b784b63bd8621572add0f9d2d51f7602c7f54f

SHA512
e0dc5d6a2a1511673a3e29405eb6bd15549984361f4ec4baed20e85a3c1677abd1f62586333b9b59e8de2048c53210d3765ed835386fca9a5dd61c2ba9d13a84

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabB8C7.tmp

Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB937.tmp

Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit